CVE-2026-40250
OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
CVE-2026-40250- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-24047
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
EUVD-2026-24047- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
CVE-2026-40250- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-40250
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
ALPINE-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-40250
- Record
BELL-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSV
OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
CVE-2026-40250- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-40250
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
DEBIAN-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-808
Integer overflow in OpenEXR's `internal_dwa_compressor`
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
JLSEC-2026-808- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2179
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2179- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2180
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2180- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2181
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1722 performs curc->width * curc->height in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other locations by the recent CVE-2026-34589 batch, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1722.(CVE-2026-40244)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.(CVE-2026-40250)
- Record
OESA-2026-2181- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-40250
CVE-2026-40250 in openexr - Patched by Root
Root has patched CVE-2026-40250 in the openexr package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-40250
CVE-2026-40250 in openexr - Patched by Root
Root has patched CVE-2026-40250 in the openexr package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-40250
CVE-2026-40250 in openexr - Patched by Root
Root has patched CVE-2026-40250 in the openexr package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-40250- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40250
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internal_dwa_compressor.h:1040 performs chan->width * chan->bytes_per_element in int32 arithmetic without a (size_t) cast. This is the same overflow pattern fixed in other decoders by CVE-2026-34589/34588/34544, but this line was missed. Versions 3.4.10, 3.3.10, and 3.2.8 contain a fix that addresses internal_dwa_compressor.h:1040.
- Record
UBUNTU-CVE-2026-40250- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10665-1 No score
libIex-3_4-33-3.4.9-4.1 on GA media
These are all security issues fixed in the libIex-3_4-33-3.4.9-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10665-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20652-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
openSUSE-SU-2026:20652-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1712-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: Integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
SUSE-SU-2026:1712-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21433-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2026-40244: integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (bsc#1262426).
- CVE-2026-40250: integer overflow in DWA decoder outBufferEnd pointer arithmetic (bsc#1262425).
- Record
SUSE-SU-2026:21433-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openexrAlpine:v3.22 |
3.2.0 up to 3.3.11-r0 | 3.3.11-r0 |
openexrAlpine:v3.23 |
3.2.0 up to 3.4.13-r0 | 3.4.13-r0 |
openexrAlpine:v3.24 |
3.2.0 up to 3.4.10-r0 | 3.4.10-r0 |
openexrAlpaquita:stream |
3.4.4-r0 up to 3.4.10-r0 | 3.4.10-r0 |
openexrDebian:12 |
All versions, plus listed versions 3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1 Show 8 moreShow less3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1 |
None known |
openexrDebian:13 |
All versions, plus listed versions 3.1.13-23.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-1 Show 4 moreShow less3.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1 |
None known |
openexrDebian:14 |
before 3.4.14-0.1, plus listed versions 3.1.13-23.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-4 |
3.4.14-0.1 |
OpenEXR_jllJulia |
3.1.4+0 up to 3.4.12+0 | 3.4.12+0 |
OpenEXRopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403sp1 | 3.1.11-8.oe2403sp1 |
OpenEXRopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403sp3 | 3.1.11-8.oe2403sp3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
OpenEXRopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 3.1.11-8.oe2403 | 3.1.11-8.oe2403 |
openexrRoot:Debian:11 |
before 2.5.4-2+deb11u1.root.io.13 | 2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18 |
rootio-openexrRoot:Debian:11 |
before 2.5.4-2+deb11u1.root.io.13 | 2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18 |
openexrRoot:Debian:12 |
before 3.1.5-5.root.io.21 | 3.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.233.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25 |
rootio-openexrRoot:Debian:12 |
before 3.1.5-5.root.io.21 | 3.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.233.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25 |
openexrRoot:Debian:13 |
before 3.1.13-2.aikido.14 | 3.1.13-2.aikido.143.1.13-2.root.io.113.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15 |
rootio-openexrRoot:Debian:13 |
before 3.1.13-2.aikido.14 | 3.1.13-2.aikido.143.1.13-2.root.io.113.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15 |
openexrUbuntu:26.10 |
All versions, plus listed versions 3.1.13-2build13.4.6+ds-4ubuntu3 |
None known |
openexropenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.4.9-4.1 | 3.4.9-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40250 is a high vulnerability (CVSS 8.4) in Academysoftwarefoundation Openexr, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in openexr 3.3.11-r0.
References
github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5qw-23x2-6phj
security.alpinelinux.org/vuln/CVE-2026-40250
docs.bell-sw.com/security/cves/CVE-2026-40250
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-40250
security-tracker.debian.org/tracker/CVE-2026-40250
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2179
suse.com/support/update/announcement/2026/suse-su-20261712-1
bugzilla.suse.com/1262425
ubuntu.com/security/CVE-2026-40250
cve.org/CVERecord?id=CVE-2026-40250